docs: def validate_yubikey_otp(self, params):
      """
      Validate YubiKey OTP using YubiHSM internal database.
      """
      vres = {}
      from_key = params["otp"][0]
      if not re.match(ykotp_valid_input, from_key):
          self.log_error("IN: %s, Invalid OTP" % (from_key))
          vres["status"] = "BAD_OTP"
      else:
          vres["otp"] = from_key
      if not "nonce" in params:
          self.log_error("IN: %s, no nonce" % (from_key))
          vres["status"] = "MISSING_PARAMETER"
      else:
          nonce = params["nonce"][0]
          if len(nonce) < 16 or len(nonce) > 40:
              self.log_error("IN: %s, bad nonce : %s" % (from_key, nonce))
              vres["status"] = "MISSING_PARAMETER"
          else:
              vres["nonce"] = nonce
      if "sl" in params and not (params["sl"] == "100" or params["sl"] == "secure"):
          self.log_error("IN: %s, sync level unsupported" % (from_key))
          vres["status"] = "BACKEND_ERROR"
      sig, client_key, = check_signature(params)
      if sig != True:
          self.log_error("IN: %s, signature validation error" % (from_key))
          if client_key == None:
              vres["status"] = "NO_SUCH_CLIENT"
              # To be compatible with YK-VAL, we will sign this response using a null key
              client_key = chr(0)
          else:
              vres["status"] = "BAD_SIGNATURE"
      if "status" not in vres:
          try:
              res = pyhsm.yubikey.validate_otp(hsm, from_key)
              vres.update({"status": "OK",
                           "sessioncounter": str(res.use_ctr), # known confusion
                           "sessionuse": str(res.session_ctr), # known confusion
                           "timestamp": str((res.ts_high << 16 | res.ts_low) / 8)
                           }
                          )
              if "sl" in params:
                  vres["sl"] = "100"
                  if "timestamp" in params:
                      vres["t"] = time.strftime("%FT%TZ0000", time.gmtime())
          except pyhsm.exception.YHSM_CommandFailed, e:
              if e.status == pyhsm.defines.YSM_ID_NOT_FOUND:
                  vres["status"] = "BAD_OTP"
              elif e.status == pyhsm.defines.YSM_OTP_REPLAY:
                  vres["status"] = "REPLAYED_OTP"
              elif e.status == pyhsm.defines.YSM_OTP_INVALID:
                  vres["status"] = "BAD_OTP"
              else:
                  vres["status"] = "BACKEND_ERROR"
              self.log_error("IN: %s, validation result %s (replying %s)" % (from_key, pyhsm.defines.status2str(e.status), vres["status"]))
  
      return make_otp_response(vres, client_key)